Authentication and access
Named accounts, strong password policy, optional multi-factor authentication for administrators, role-based permissions and least-privilege access to production.
Business systems hold member records, payments, tenant data and staff activity. This page explains the controls Zama Systems LTD applies, how we handle personal data, and what enterprise buyers can review during due diligence.
Controls are applied according to project risk, hosting model and contractual requirements.
Named accounts, strong password policy, optional multi-factor authentication for administrators, role-based permissions and least-privilege access to production.
HTTPS/TLS for all public and administrative traffic, secure webhook endpoints and signed or verified payment callbacks.
Database and file access restricted to application and administrative accounts, encrypted backups, and controlled export of personal data.
Recorded creation, edits, approvals and payment actions where the workflow requires accountability, with role-based visibility.
Scheduled backups, retention rules, restore testing and documented recovery steps. Recovery objectives are agreed in the SLA.
Application and server logs for errors, access and suspicious activity, with alerting for critical failures.
Separate development, staging and production environments, code review, dependency updates and controlled deployment.
Documented triage, containment, resolution and post-incident review, with client notification per the agreed SLA.
Our approach is aligned with the Kenya Data Protection Act, 2019 and the expectations of the Office of the Data Protection Commissioner.
For client systems, the client is normally the data controller and we act as a data processor. The lawful basis, notice and consent wording remain the controller's responsibility.
We design forms and database fields around the minimum information needed for the workflow, and avoid collecting sensitive data without a defined purpose.
Retention periods are agreed with the client. Deletion, archival and export procedures are documented and can be automated where required.
Systems can support access, correction and deletion requests through administrative tools, exports and documented procedures.
Hosting, messaging, payment and monitoring providers are disclosed in the data processing agreement and reviewed for suitability.
Where a personal-data breach occurs, we support the client's assessment, containment and any required notification to the ODPC and affected individuals.
M-Pesa integrations use Safaricom Daraja APIs with client-provided credentials. We store transaction references, amounts and status, not customer M-Pesa PINs.
Where card payments are required, we integrate a compliant payment provider and do not store card numbers or CVV data in client systems.
WhatsApp and SMS integrations use official providers and client-owned sender identities, with opt-in and message content controlled by the client.
Security is a joint responsibility between the software provider, the hosting provider and the client organisation.
Secure development, application access control, backup configuration, monitoring, incident response and support within the agreed scope.
User onboarding and offboarding, device security, staff training, approval of access levels, and timely reporting of suspicious activity.
Physical security, network isolation, infrastructure patching and platform availability, as defined in the hosting agreement.
If you believe you have found a vulnerability in a Zamacore system, contact us privately before public disclosure.
Send the affected URL, a description, reproduction steps and any supporting evidence. We will acknowledge the report, investigate and keep you updated on remediation.
We do not claim certifications we do not hold. We implement documented security controls and can provide control descriptions and evidence for your security review. Certification status is confirmed in writing during procurement.
Hosting is agreed per project. We use reputable cloud or dedicated hosting with TLS, restricted administrative access, backups and monitoring. Data residency requirements are confirmed during discovery.
Yes. Where we process personal data on behalf of a client, we sign a data processing agreement that defines purpose, duration, categories of data, security measures and sub-processors.
Incidents are logged, triaged by severity, contained, resolved and reviewed. Contracted clients receive notification according to the agreed SLA and, where personal data is affected, support for any required regulatory notification.